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NOTICE 


Statements that managerial practices need improvements, as well as other conclusions 
and recommendations in this report, represent the opinions of the Office of Inspector 
General. The appropriate Department of Education officials will determine what 
corrective actions should be taken. 


In accordance with Freedom of Information Act (Title 5, United States Code, 

Section 552), reports that the Office of Inspector General issues are available to 
members of the press and general public to the extent information they contain is not 
subject to exemptions in the Act. 


UNITED STATES DEPARTMENT OF EDUCATION 
OFFICE OF INSPECTOR GENERAL 


Audit Services 


July 17, 2019 


TO: Mark A. Brown 
Chief Operating Officer 
Federal Student Aid 


FROM: Bryon S. Gordon /s/ 
Assistant Inspector General for Audit 


SUBJECT: Final Audit Report, “Federal Student Aid’s Oversight of Schools’ Compliance with 
Satisfactory Academic Progress Regulations,” Control Number ED-OIG/A04S0012 


Attached is the subject final audit report that consolidates the results of our review of Federal Student 
Aid’s oversight of schools’ compliance with satisfactory academic progress regulations. We have 
provided an electronic copy to your audit liaison officers. We received your comments, including 
corrective actions that Federal Student Aid has planned or implemented, in response to the findings and 
recommendations in our draft report. 


U.S. Department of Education policy requires that you develop a final corrective action plan within 

30 days of the issuance of this report. The corrective action plan should set forth the specific action 
items and targeted completion dates necessary to implement final corrective actions on the findings and 
recommendations contained in this final audit report. Corrective actions that your office proposes and 
implements will be monitored and tracked through the Department’s Audit Accountability and 
Resolution Tracking System. 


In accordance with the Inspector General Act of 1978, as amended, the Office of Inspector General is 
required to report to Congress twice a year on the audits that remain unresolved after 6 months from 
the date of issuance. 


We appreciate your cooperation during this review. If you have any questions, please contact me at 
(202) 245-6051 or Bryon.Gordon@ed.gov or Christopher Gamble, Regional Inspector General for Audit 
at (404) 974-9417 or Christopher.Gamble@ed.gov. 


Attachment 


400 MARYLAND AVENUE, S.W., WASHINGTON, DC 20202-1510 


Promoting the efficiency, effectiveness, and integrity of the Department's programs and operations. 
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Results in Brief 


What We Did 


The objectives of our audit were to determine (1) whether Federal Student Aid (FSA) 
ensured completion of corrective actions in response to audit and program review 
findings related to satisfactory academic progress (SAP), and (2) what actions FSA has 
taken to assist schools with compliance with SAP requirements. Our audit covered 
compliance audits and program reviews for which FSA either issued a final 
determination letter or screened the audit report and confirmed it as complete from 
October 1, 2015, through September 30, 2017, and FSA’s actions to assist schools with 
SAP compliance during that same period. 


FSA’s Program Compliance office annually conducts program reviews of about 

300 postsecondary schools participating in Title IV programs to determine whether 
schools are complying with Title IV program requirements. For each of these reviews, 
the Program Compliance office issues a program review report to the school, identifying 
any findings and required corrective actions. The Program Compliance office tracks 
corrective actions through resolution. 


Postsecondary schools must submit an annual compliance audit to FSA. FSA’s contractor 
enters deficiency codes (related to audit findings identified in the audit reports) into eZ- 
Audit (for domestic schools) or the Postsecondary Education Participants System (PEPS) 
(for foreign schools), which automatically classify the audits as either deficient or non- 
deficient. FSA’s contractor sends all deficient audits to the Program Compliance office 
for audit resolution. For non-deficient audits, the Program Compliance office relies on 
the school’s auditor to ensure the school completed corrective actions. 


To accomplish our objectives, we reviewed samples consisting of 27 compliance audits 
(15 deficient audits and 12 non-deficient audits) and 21 program reviews, all with at 
least one SAP finding, to determine whether FSA ensured these schools completed the 
required corrective actions. We also reviewed documentation and interviewed FSA 
staff to determine the actions FSA has taken to assist schools with compliance with SAP 
requirements. 


1 The results from our samples pertain only to the compliance audits and program reviews sampled and 
cannot be projected because we included judgmentally selected items and used auditor judgment to 
determine the count of randomly selected items. 
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What We Found 


FSA did not always ensure schools completed corrective actions related to the SAP 
findings identified in compliance audits and program reviews. This occurred because 
FSA’s Program Compliance office did not always perform the required resolution 
activities or address all SAP-related findings in the final determination letters. FSA’s 
failure to resolve SAP-related findings could result in (1) schools with repeated SAP 
findings, (2) ineligible students receiving Title IV program funds, (3) noncompliant 
schools continuing to participate in Title IV programs, or (4) FSA not establishing 
liabilities payable from schools that disbursed Title IV program funds to students who 
did not meet SAP requirements. 


FSA’s Program Compliance office took actions to assist schools with compliance with 
SAP requirements by providing assistance to new schools, an SAP assessment tool, the 
FSA Handbook that addresses SAP requirements, and web-based and in-person SAP- 
related training. 


What We Recommend 


We recommend that FSA— 


e ensure Program Compliance office staff are aware of the policies and 
procedures for 


o addressing repeat findings in final audit determination letters and 


oO requesting additional documentation to determine students’ eligibility 
for Title IV program funds to assess liabilities when schools disburse 
funds to ineligible students due to SAP violations or when schools close 
before they complete their required file reviews; 


e revise the system logic in PEPS so that it identifies audits with repeat findings as 
deficient; and 


e develop and implement controls to identify deficient foreign school compliance 
audits for audit resolution. 


FSA’s Comments 


In its response to the draft report, FSA did not explicitly agree or disagree with Finding 1. 
However, FSA stated that the exceptions concerning deficient compliance audits and 
program reviews were identified through judgmental sampling for which results cannot 
be projected and were not systemic issues but rather individual exceptions where a 
procedure was not followed. Nonetheless, for the exceptions reported, FSA agreed that 
(1) policies and procedures related to final audit determination letters must be 
followed, (2) additional research should have been done to determine whether 
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ineligible students received funds, and (3) program review policies and procedures 
related to closed schools must be followed. For the exception concerning the non- 
deficient compliance audits of foreign schools, FSA was not aware of the system error 
and appreciated the OIG’s identification of the issue. FSA agreed with all four 
recommendations related to Finding 1. FSA did not explicitly agree or disagree with 
Finding 2, which was a positive finding and did not include any recommendations. 


OIG’s Response 


We revised Finding 1 and Recommendations 1 and 2 to make clear that the exceptions 
concerning deficient compliance audits and program reviews were based on individual 
exceptions where the Program Compliance office staff did not always ensure that SAP- 
related corrective actions were completed by the schools. We summarized FSA’s 
comments at the end of Finding 1 and included the full text of FSA’s comments at the 
end of this report. 
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Introduction 


Background 


The U.S. Department of Education (Department) provides financial assistance to 
students attending postsecondary schools through Title IV programs in the form of 
loans, grants, and work-study. According to FSA, for award year 2017-2018, domestic 
postsecondary schools awarded $117.8 billion and foreign postsecondary schools 
awarded $1.4 billion in Title IV Federal financial aid program funds to postsecondary 
students and their families. 


Effective oversight and monitoring of program participants is necessary for FSA to 
ensure that funds are disbursed to only eligible students and to effectively manage the 
performance of the Federal student loan portfolio. The Department identified 
noncompliance with SAP as a root cause for improper payments in the Federal Pell 
Grant and William D. Ford Direct Loan programs in its fiscal years 2012 through 2018 
Agency Financial Reports. In addition, findings related to SAP were included in FSA’s list 
of “Top Ten Domestic School Program Review Findings by Number of Findings” from 
fiscal year (FY) 2013 through FY 2018. 


According to 34 C.F.R. § 668.16, to participate in any Title IV, Higher Education Act 
program, an institution must demonstrate that it is capable of adequately administering 
the program. Eligible institutions must establish, publish, and apply reasonable 
standards for measuring whether a student is maintaining satisfactory academic 
progress in the student’s academic program (SAP policy). According to § 668.34, key 
items in an SAP policy include the following: 


e whenastudent’s academic progress will be evaluated; 


e the grade point average (or comparable assessment) that a student must 
achieve at each evaluation period; 


e the pace at which a student must progress through his or her educational 
program to ensure that the student will complete the program within the 
maximum timeframe; 


e how course incompletes, withdrawals, repetition, or transfer credits affect a 
student’s grade point average and pace of completion; and 


e =the effect on a student’s eligibility to receive assistance under the Title IV 
programs if the student does not achieve the required grade point average or is 
not successfully completing his or her program at the required pace. 


To be eligible to receive Title IV assistance, an otherwise eligible student must maintain 
SAP in his or her course of study. Before disbursing Title IV program funds to a student, 
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the school must confirm that the student meets the SAP standards established in its SAP 
policy. FSA manages the administrative and oversight functions that support Title IV 
programs, which includes ensuring that schools are complying with the SAP regulations. 


Compliance Audits 

Schools submit their required annual compliance audits to FSA. An FSA contractor 
screens the compliance audit reports by first entering pertinent information into the eZ- 
Audit system (for domestic school audits) or PEPS (for foreign school audits) and, for 
compliance audits with findings, verifies that the audit reports include corrective action 
plans related to the auditor’s findings. If a corrective action plan is not included, the 
contractor rejects the audit report as incomplete and sends it back to the school to 
include the required corrective action plan. Based on criteria embedded within eZ-Audit 
and PEPS, the systems run a process on the inputted data to classify the audits as non- 
deficient or deficient. 


Audits that have no findings or findings that FSA considers as minor are classified as 
non-deficient.* Non-deficient audits are archived in eZ-Audit and are not sent to the 
Program Compliance office. The Program Compliance office relies solely on the school’s 
auditor to ensure that the school completed corrective actions related to findings 
identified in non-deficient audit reports. The school’s auditor documents the completion 
status of corrective actions in the subsequent year’s audit report. 


According to the Program Compliance office’s Compliance Audit Procedures, a deficient 
audit is one that contains any one of the following criteria: questioned costs of $10,000 
or more; error rate greater than or equal to 10 percent for significant findings; error rate 
greater than or equal to 20 percent for minor findings; automatic deficiency code; ? 
repeat finding; or an eZ-Audit system flag that signals for the audit to be routed to the 
Program Compliance office for resolution (flags include, for example, the absence of 
required management assertions, a reportable condition, or a material weakness). The 
only compliance audits that are subjected to the Program Compliance office’s audit 
resolution process are those that meet one of the five criteria listed above. 


During audit resolution, an audit resolution specialist reviews the compliance audit 
report findings, ensures that the audit report contains corrective actions and that the 


FSA provided its contractor with “FSA’s Deficiency Codes,” which lists audit findings as minor or 
significant based on FSA’s policies and procedures. 


3 Examples of automatic deficiency codes include a disclaimer or adverse auditor opinion, or an ineligible 
student. Audit reports with a disclaimer of opinion or an adverse opinion reflect the possibility of major 
findings at a school. 
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corrective actions address the findings, and requires assurance that the school has or 
will implement the corrective actions related to the findings. At the conclusion of the 
audit resolution process, the Program Compliance office issues a final audit 
determination letter to the school which includes the corrective actions the school is 
required to implement to resolve the audit findings. 


Program Reviews 

As part of its oversight responsibility, FSA annually conducts program reviews of about 
300 schools participating in Title IV programs to determine whether schools are 
complying with Title IV program requirements such as SAP. After performing the 
program reviews, the Program Compliance office issues the school a program review 
report containing any findings and required corrective actions. The school reviews the 
program review report and submits a written response to the findings and 
documentation‘ to support its implementation of the related corrective actions. The 
Program Compliance office reviews the school’s response and supporting 
documentation to determine whether the school completed the corrective actions 
related to the findings. If the school completes all corrective actions and does not owe 
any related outstanding liabilities> to the Department, the Program Compliance office 
issues the school a final program review determination letter that indicates no further 
action is required and that the review is closed. If the school does not complete all 
corrective actions related to the findings or the school owes any assessed liabilities to 
the Department, the Program Compliance office issues a final program review 
determination letter with the corrective actions the school is required to take to resolve 
the findings. After the school provides sufficient documentation to support that it has 
implemented the required corrective actions listed in the final program review 
determination letter and paid any assessed liabilities,® the Program Compliance office 
issues a close-out letter to the school. 


4 Examples of supporting documentation that the schools submitted to the Program Compliance office 
are revised SAP policies and spreadsheets with student file review results. 


> For example, FSA could assess liabilities payable from schools for noncompliance FSA identified in 
compliance audits and program reviews. 


5 The Program Compliance office contacts the Department’s Office of the Chief Financial Officer and 
requests documentation that supports the school’s remittance of the payment. 
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Finding 1. FSA Did Not Always Ensure Schools 


Completed Corrective Actions 


Based on the compliance audits and program reviews we reviewed, we determined that 
FSA did not always ensure schools completed corrective actions related to the identified 
SAP findings. Specifically, the Program Compliance office did not always ensure the 
schools completed SAP-related corrective actions for the following compliance audits 
and program reviews that we reviewed:’ 


e 4Aofthe 15 compliance audits that were classified as deficient,® 
e 7ofthe 12 compliance audits that were classified as non-deficient,? and 
e ofthe 21 program reviews. 


Corrective actions were not taken because FSA’s Program Compliance office did not 
always perform the required resolution activities or address all SAP-related findings in 
the final determination letters. As a result, schools may have repeated SAP findings, 
ineligible students may receive Title IV program funds, noncompliant schools may 
continue to participate in Title IV programs, and FSA may not establish liabilities payable 
from schools that disbursed Title IV program funds to students that did not meet SAP 
requirements. 


For the remaining 11 compliance audits classified as deficient, the Program Compliance 
office ensured schools completed the required corrective actions; for the remaining 

5 compliance audits classified as non-deficient, according to subsequent audit reports 
for the schools, all corrective actions were implemented; and for the remaining 

20 program reviews, the Program Compliance office ensured schools completed the 
required corrective actions. 


Deficient Compliance Audits 


From October 1, 2015, though September 30, 2017, FSA audit resolution specialists 
resolved 2,462 deficient compliance audits performed by independent public 
accountants. Of those, 80 contained at least one SAP-related finding. We reviewed a 


7 Because we used judgment to determine random sample sizes and did not weight results by 
probabilities of selection and used a judgmental sample, the results from our samples pertain only to 
the compliance audits and program reviews sampled and cannot be projected. 


8 All 4 audits were of domestic schools. 
° All 7 audits were of foreign schools. 
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sample of 15 of the 80 compliance audits and found that for 11, the Program 


Compliance office ensured the school completed the required corrective actions. We 
determined that these corrective actions would likely address findings and that the 


Program Compliance office included the required components of the SAP finding and 


related corrective actions in the final audit determination letter. However, for 4 of the 


15 audits in our sample, the Program Compliance office did not always ensure the 


schools completed the SAP-related corrective actions, as described in the following. 


One of the four audits had a repeat finding that the school’s SAP policy was not 
in compliance with SAP regulations. Although the Program Compliance office 
reviewed the school’s reported corrective actions and determined that the 
corrective actions would address the finding, the Program Compliance office did 
not include all required elements in the final audit determination letter. 
Specifically, the letter did not include the SAP regulations that were violated, 
the school’s response to the finding, and the required corrective actions that 
the school must implement. The Audit Resolution Specialist responsible for 
resolving the audit stated that she did not address the repeat SAP finding in the 
final audit determination letter because of time constraints and because the 
finding appeared in only two consecutive audit reports (FY 2014 and FY 2015). 


One of the four audits had a finding that up to 52 students at a school may have 
been ineligible to receive Title lV program funds. The auditor recommended 
that the school revise its SAP policy and await guidance from the Department 
regarding the finding. In its final audit determination letter, the Program 
Compliance office required the school to provide a revised SAP policy. However, 
it did not require the school to provide documentation indicating whether the 
52 students were eligible for Title lV program funds and to establish a liability 
for the amount of Title IV program funds disbursed to any students found to be 
ineligible. As a result, the SAP-related finding was only partially addressed. The 
Audit Resolution Specialist responsible for resolving the audit stated that 
because the auditor did not question the costs related to the students, she did 
not request additional information to determine whether the students were 
eligible to receive Title IV program funds. 


The remaining two of the four audits each identified a student who received 
Title IV program funds without meeting SAP requirements. The Program 
Compliance office required each school to revise its SAP policy. However, the 
Program Compliance office did not require the schools to provide additional 
documentation so that it could assess the liabilities for Title IV program funds 
disbursed to ineligible students. Both of the Audit Resolution Specialists 
responsible for resolving the audits explained that they did not request 
additional information to assess these liabilities for the ineligible students 
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because each was an isolated instance and the auditor did not question the 
costs in the audit report. 


FSA’s Compliance Audit Procedures, dated June 25, 2014, require the Program 
Compliance office to resolve repeat findings during audit resolution and include the 
repeat finding in the final audit determination letter issued to the school. According to 
Section 4.7.5.3.3, a “repeat finding .. . is a significant finding . . . [and] the ARS [audit 
resolution specialist] must address the repeat finding in the FAD [final audit 
determination].” 


According to Section 4.5 of FSA’s Compliance Audit Procedures, dated June 25, 2014, 
“The ARS requests additional information from the institution or auditor when it is 
needed to determine the extent of the violation cited by the auditor, whether the 
corrective actions have been taken, and if liabilities need to be assessed.” According to 
Section 1 of FSA’s Compliance Audit Procedures, an ARS assesses liability for errors 
identified in compliance audits. 


Non-Deficient Compliance Audits 


From October 1, 2015, through September 30, 2017, FSA’s screening process confirmed 
completeness of 7,048 non-deficient compliance audits of postsecondary schools 
performed by independent public accountants.*° Of those, 24 contained at least one 
SAP-related finding, according to the documentation that FSA provided.*! We reviewed 
12 of the 24 compliance audits to determine whether the Program Compliance office 
correctly classified the audits as non-deficient”? and ensured that the schools completed 
the SAP-related corrective actions. We found that for 5 of the 12 audits, the Program 
Compliance office correctly classified the audits as non-deficient and all the SAP-related 
corrective actions were implemented according to the subsequent audit reports for the 


1° The 7,048 non-deficient compliance audits include 6,502 domestic school audits and 546 foreign 
school audits. 


11 The 24 compliance audits that contained at least one SAP-related finding include 12 domestic school 
audits and 12 foreign school audits. 


? Audits that have no findings or findings that FSA considers as minor are classified as non-deficient and 
are not sent to the Program Compliance office. For non-deficient audits, the Program Compliance office 
relies on the school’s auditor to ensure the school completed corrective actions. 
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schools.*? For the remaining 7 of the 12 compliance audits, we found that the audits 
contained repeat findings, some of which were SAP-related findings, which means they 
should have been classified as deficient. All seven compliance audits were conducted on 
foreign schools and were therefore tracked in PEPS, the system of record for foreign 
school compliance audits.’* Because the seven audits were incorrectly classified as non- 
deficient instead of deficient, the Program Compliance office did not ensure these seven 
schools completed the SAP-related corrective actions as required. 


For three of the seven foreign school compliance audits, PEPS incorrectly classified the 
audits as non-deficient, even though the FSA contractor correctly entered the code that 
represents a repeat finding into PEPS. Once a user enters a code into PEPS, the system 
automatically checks that code against the Deficiency Code Reference Table, which 
contains a list of deficiency codes that automatically deem a compliance audit as 
deficient. However, the repeat finding code is not listed in the reference table, so PEPS 
did not automatically designate that audit (or other audits with the code for repeat 
findings) as deficient. The Team Director of the Operations Support Division in the 
Program Compliance Office (Team Director) stated that the system does not have a 
manual intervention process to change incorrectly classified compliance audits with a 
repeat finding code to a deficient status. 


For the remaining four of the seven foreign school compliance audits that were 
incorrectly classified as non-deficient, the FSA contractor did not enter the code that 
represents a repeat finding into PEPS even though the audits contained repeat findings. 
According to the Team Director, FSA has no controls to ensure that the contractor 
enters accurate and complete data into PEPS. 


According to Section 3.1.3 of FSA’s Compliance Audit Procedures, dated 

November 2, 2012, a deficient audit is one that contains one or more of the following: 
questioned costs of $10,000 or more; error rate greater than or equal to 10 percent for 
significant findings; error rate greater than or equal to 20 percent for minor findings; 
automatic deficiency code; repeat finding; or an eZ-Audit system flag. FSA’s contractor 
provides deficient foreign school audits to the School Participation Division, School 


13 FSA’s Program Compliance office ensures that schools completed corrective actions by relying on the 


schools’ auditor to report in the subsequent year’s audit report the implementation status of the 


previous year’s corrective actions. 


4 According to FSA, foreign schools awarded $1.4 billion (1.1 percent) of the total Title IV Federal 


financial aid program funds awarded for award year 2017-2018. 
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Eligibility Services Group (within the Program Compliance office), for full audit 
resolution. 


According to the U.S. Government Accountability Office’s Standards for Internal Control 
in the Federal Government (2014), Attributes 10.02, 10.06, and 12.01, management 
designs control activities in response to the entity’s objectives and risks to achieve an 
effective internal control system. If the entity relies on wholly or partially automated 
control activities for its operations, management designs the controls so that the 
information technology operates properly. Management should implement control 
activities through policies. In addition, according to the U.S. Government Accountability 
Office’s Internal Control Management and Evaluation Tool (2001), control activities 
described in policies should be properly applied. 


The Program Compliance office lacks controls to prevent and detect errors in the 
process it uses to classify foreign school audits as deficient. Due to the lack of controls, it 
is likely that foreign school compliance audits that were not included in this review 
could also have been incorrectly classified as non-deficient, and therefore were not 
subject to the Program Compliance office’s audit resolution process to address SAP- 
related findings and other significant findings. 


Program Reviews 


From October 1, 2015, through September 30, 2017, FSA’s institutional review 
specialists issued a final determination letter for 567 program reviews of postsecondary 
schools. Of those, 143 program reviews had at least one SAP-related finding. We 
reviewed a sample of 21 of the 143 and found that for 20, the Program Compliance 
office ensured the schools completed the SAP-related corrective actions. We also 
determined that the corrective actions for the 20 program reviews would likely address 
the SAP finding. However, for 1 of the 20 program reviews in our sample, the Program 
Compliance office did not require the school to complete corrective actions that could 
address the reported SAP-related finding. 


In the one program review, FSA found the school had not developed an adequate SAP 
policy. As a result, FSA required the school to revise its SAP policy and to perform a 
comprehensive file review based on its revised SAP policy. In response to the corrective 
action, the school provided a revised SAP policy; however, the school closed before it 
completed the comprehensive file review. When a school closes without completing a 
required comprehensive file review, Section 22.5.2.2.5 of FSA’s Program Review 
Procedures, dated January 6, 2015, require the Program Compliance office to include in 
the final program review determination letter a corrective action for the school to repay 
all Title 1V program funds that were disbursed to students selected for the file review. In 
this case, the Program Compliance office closed the program review without requiring 
the school to repay the funds to the Department. The institutional review specialist 
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responsible for the program review incorrectly believed that if a school closed before 
completing a required comprehensive file review, and the school provided a response to 
another finding in the same program review report, then the school is not required to 
repay funds associated with the file review. 


As described in the sections above, FSA’s Program Compliance office staff and FSA’s 
contractor did not follow established policies and procedures for ensuring that schools 
completed corrective actions identified in compliance audits and program reviews. The 
failure to follow such policies and procedures could result in (1) schools with repeated 
SAP findings, (2) ineligible students receiving Title IV program funds, (3) schools with 
noncompliant SAP policies continuing to participate in the Title IV programs, or (4) FSA 
not establishing liabilities payable from noncompliant schools. 


Recommendations 


We recommend that the Chief Operating Officer for FSA— 


1. Ensure that audit resolution specialists in the Program Compliance office are 
aware of the requirement to address all repeat findings in a final audit 
determination letter. 


2. Ensure audit resolution specialists and institutional review specialists in the 
Program Compliance office are aware of the policies and procedures for 
requesting additional documentation when it is needed to determine students’ 
eligibility for Title |V program funds and assessing liabilities in instances when (a) 
SAP violations result in Title 1V program funds being disbursed to ineligible 
students and (b) a school closes before it completes a required file review. 


3. Revise the system logic in PEPS to ensure that audits coded with a repeat finding 
code are identified as deficient by that system. 


4. Develop and implement controls to prevent and detect errors in the Program 
Compliance office’s process for identifying deficient foreign school compliance 
audits for audit resolution. 


FSA’s Comments 


In its response to the draft report, FSA did not explicitly agree or disagree with Finding 1. 
However, FSA stated that the exceptions concerning deficient compliance audits and 
program reviews were identified through judgmental sampling for which results cannot 
be projected and were not systemic issues but rather individual exceptions where a 
procedure was not followed. Nonetheless, for the exceptions reported, FSA agreed that 
(1) policies and procedures related to final audit determination letters must be 
followed, (2) additional research should have been done to determine whether 
ineligible students received funds, and (3) program review policies and procedures 
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related to closed schools must be followed. For the exception concerning the non- 
deficient compliance audits of foreign schools, FSA was not aware of the system error 
and appreciated the OIG’s identification of the issue. FSA agreed with all four 
recommendations related to Finding 1. 


OIG’s Response 


We revised Finding 1 and Recommendations 1 and 2 to make clear that the exceptions 
concerning deficient compliance audits and program reviews were based on individual 
exceptions where the Program Compliance office staff did not always ensure that SAP- 
related corrective actions were completed by the schools. 
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Finding 2. FSA Took Actions to Assist Schools 


with Compliance with Satisfactory Academic 
Progress Requirements 


FSA’s Program Compliance office took actions to assist schools with compliance with 
SAP requirements. These actions included providing web-based and in-person SAP- 
related training, new school assistance, an SAP assessment tool, and the FSA Handbook 
that addresses SAP requirements. 


Training 


FSA maintained a website containing training courses on various financial aid topics, 
including SAP. During FYs 2016 and 2017, the website included a short video course on 
SAP and an interactive course covering a general overview, policy development, and 
implementation of SAP. In addition, each year FSA holds an annual training conference 
that all schools are invited to attend. FSA offered a separate training course specifically 
on SAP at its 2015 and 2016 conferences. FSA also offered a training class at the 
conferences on the subjects that were included in its Top 10 Program Review Findings, 
which list the 10 most common types of findings. SAP noncompliance was in the Top 10 
Program Review Findings during our scope period (FYs 2016 and 2017). 


New School Assistance 


Institutional improvement specialists within the Program Compliance office work with 
new schools before the schools receive Title IV program funds in a process called 
precertification review. The institutional improvement specialists work with the schools 
again 6 months to a year after the school starts receiving Title IV program funds ina 
process called the new school visit. During the precertification reviews and new school 
visits, among other things, the institutional improvement specialist reviews the school’s 
SAP policy to ensure that it complies with SAP regulations. If the school’s SAP policy 
does not comply with SAP regulations, the institutional improvement specialist works 
with the school to bring the policy into compliance. These visits allow the institutional 
improvement specialist to prevent, detect, and resolve new schools’ noncompliance 
with SAP requirements. We reviewed examples of precertification reviews and new 
school visits and confirmed that the institutional improvement specialists reviewed 
schools’ SAP policies and ensured schools resolved identified issues. 


Tools on FSA’s Website 


For the 2015-2016 and 2016-2017 academic years, FSA posted an SAP Assessment tool 

on its website for schools to perform self-assessments on their compliance with SAP 

requirements. For those same academic years, FSA also posted an FSA Handbook, which 

has two chapters discussing SAP requirements, on its website to inform schools about 
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Title IV program compliance requirements. As a result of these actions, FSA provided 
schools with information to help them comply with SAP requirements. 


U.S. Department of Education 
Office of Inspector General 
ED-OIG/A04S0012 


15 


Appendix A. Scope and Methodology 


Our audit covered FSA’s control activities related to schools’ compliance with SAP 
requirements. Specifically, our audit covered FSA’s policies, procedures, and other 
controls to ensure that schools completed corrective actions related to SAP findings 
identified in compliance audits and program reviews for which FSA either issued a final 
determination letter or screened the audit report and confirmed it as complete from 
October 1, 2015, through September 30, 2017. In addition, the audit covered FSA’s 
actions to assist schools with compliance with SAP requirements. We held an entrance 
conference with FSA on June 11, 2018, and an exit conference on November 9, 2018. 


To achieve our audit objectives we performed the following procedures. 


e We reviewed the following laws, regulations and guidance: 


o Title 34, Code of Federal Regulations, Sections 668.16(e), 668.32(f), and 
668.34; 


o Higher Education Act of 1965, as amended, Sections 141 and 498A; and 


o U.S. Government Accountability Office’s Standards for Internal Control 
in the Federal Government (2014). 


e We reviewed FSA’s and its contractor’s policies and procedures including the 
following: 


o  FSA’s Program Review Procedures (2015); 
o  FSA’s Compliance Audit Procedures (2012 and 2014); 


o  FSA’s Technical and Business Support Service Group’s Compliance Audit 
and Financial Statements Quality Control Review Procedures; 


oO FSA’s Institutional Improvement Specialist Procedures (2013); 
o  FSA’s New School Guide (2009); 

o FSA's Eligibility Procedures (2014); 

o FSA’s Deficiency Codes (2012);*° 


o Compliance Audit Analysis: Uniformed Guidance Submissions (written 
by FSA’s contractor); 


15 FSA’s Deficiency Codes (2012) applies to both eZ-Audit and PEPS. 
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o eZ-Audit Compliance Audit Analysis: Proprietary School — Student 
Financial Assistance Audit Guide Submission (written by FSA’s 
contractor); and 


o Document Receipt and Control Center Compliance Audit Procedures 
(written by FSA’s contractor). 


We interviewed officials from FSA’s Program Compliance office, including all 
eight School Participation Divisions of the School Eligibility Services Group, the 
Performance Improvement and Procedures Service Group, and the Technical 
and Business Support Service Group. 


We interviewed FSA’s designated contractor for processing school compliance 
audits. 


We reviewed samples of compliance audits and program reviews for which FSA 
either issued a final determination letter or screened the audit report and 
confirmed it as complete within our audit scope to determine how FSA ensured 
schools completed the corrective actions related to SAP findings. 


We reviewed examples of new school visits and precertification reviews to 
determine how SAP compliance was incorporated into the reviews. 


We reviewed FSA’s e-training website to identify training courses related to SAP. 


We reviewed the presentations related to SAP that were presented at FSA’s 
2015 and 2016 annual training conferences. 


We reviewed the Top 10 Program Review Findings and the Top 10 Compliance 
Audit Findings for FYs 2013 through 2017 presented at FSA’s annual training 
conferences. 


We reviewed FSA’s SAP assessment tool. 


We reviewed FSA’s Federal Student Aid Handbook for award years 2015-2016 
and 2016-2017. 


Sampling Methodology 


We reviewed two samples of compliance audits and two samples of program reviews 


for the following purposes: 


For assessing data reliability of PEPS, we reviewed a stratified random sample of 
25 program reviews out of the 567 program reviews with final program review 
determination letters issued from October 1, 2015, through September 30, 
2017. 
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e To determine whether FSA’s Program Compliance office followed its policies 
and procedures for ensuring schools completed corrective actions related to 
SAP findings in program reviews, we reviewed a stratified random sample of 21 
of 143 program reviews that identified at least one SAP finding within our audit 
scope. 

e To determine whether FSA’s Program Compliance office followed its policies 
and procedures for ensuring schools completed corrective actions related to 
SAP findings in deficient compliance audits, we reviewed a randomly selected 
sample of 15 of 80 deficient compliance audits that identified at least one SAP 
finding within our audit scope. 

e To determine whether FSA’s Program Compliance office followed its policies 
and procedures for ensuring schools completed corrective actions related to 
SAP findings in 24 non-deficient compliance audits, we reviewed the 7 non- 
deficient compliance audits that should have been classified as deficient and an 
additional 5 selected randomly. 


Because we used judgment to determine random sample sizes and did not weight 
results by probabilities of selection and also used a judgmental sample, the results from 
our samples pertain only to the compliance audits and program reviews sampled and 
cannot be projected. 


Samples of Program Reviews for Data Reliability 

We used PEPS data that FSA’s Program Compliance office and our Computer Assisted 
Assessment Techniques team provided to identify 567 program reviews with final 
program review determination letters issued from October 1, 2015, through 
September 30, 2017. We selected 25 program reviews, randomly selecting 10 of the 
143 reviews that identified at least one SAP finding and 15 of the remaining 

424 program reviews that did not identify at least one SAP finding. For the 25 sampled 
reviews, we reviewed the final program review determination to determine whether 
PEPS contained accurate report dates, program review control numbers, and findings 
identified in the reports. 


Samples of Program Reviews for Testing 

We stratified 143 program reviews that identified at least one SAP finding by the school 
participation division that completed the review resulting in 8 strata. We randomly 
selected program reviews from each stratum (school participation division), for a total 
of 21 program reviews. Table 1 shows the number of program reviews and sample size 
for each school participation division. 
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Table 1. Program Review Universe and Sample Sizes 


School Participation Division Universe 
Atlanta 32 5 
Chicago-Denver 28 3 
Dallas 12 2 
Kansas City 28 3 
Multi-Regional and Foreign Schools 1 AL 
New York-Boston 19 3 
Philadelphia 5 2 
San Francisco-Seattle 18 2 
Total 143 21 


For each of the 21 program reviews sampled, we reviewed the program review report, 
final program review determination letter, and documentation supporting that the 
school completed corrective actions related to the SAP findings identified in the 
program reviews. We also determined whether the corrective actions would likely 
address the SAP finding. 


Samples of Deficient Compliance Audits for Testing 

FSA’s Program Compliance office provided a universe of 2,462 deficient compliance 
audits from the eZ-Audit system and PEPS”® with a final audit determination letter 
issued from October 1, 2015, through September 30, 2017. Of the 2,462 deficient 
compliance audits, FSA identified 80 that contained at least one SAP finding. We 
stratified the 80 compliance audits by the school participation division resulting in eight 
strata. We selected a random sample of two compliance audits from each of seven 


16 Only the foreign school compliance audits came from PEPS. Domestic school compliance audits came 
from the eZ-Audit system. 
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strata (school participation divisions), and one from the eighth stratum,” for a total 
sample size of 15 deficient compliance audits that contained at least one SAP finding. 


For each of the 15 compliance audits, we reviewed the audit report and final audit 
determination letter to identify the SAP finding and related corrective actions. For the 
compliance audits in which the school completed the SAP-related corrective actions 
prior to issuance of the final audit determination letter, we obtained supporting 
documentation. For the compliance audits in which the school had not completed the 
SAP-related corrective action prior to issuance of the final audit determination letter, 
we determined whether FSA’s Program Compliance office had assurance that the 
corrective action would be implemented. In addition, for all 15 compliance audits 
sampled we determined whether the corrective actions would likely address the SAP 
finding. 


Samples of Non-Deficient Compliance Audits for Testing 

FSA’s Program Compliance office provided a list of 7,048 non-deficient compliance 
audits *® from the eZ-Audit system and PEPS?? that FSA’s screening process confirmed as 
complete from October 1, 2015, through September 30, 2017. Of the 7,048 compliance 
audits, 24 contained at least one SAP finding (12 audits of foreign schools and 12 audits 
of domestic schools). We reviewed the list of 24 audits and noticed that three of the 
audits were for the same foreign school (one audit for each of three different fiscal 
years), which could indicate repeat findings. FSA considers audits with repeat findings as 
deficient audits based on its compliance audit policies and procedures. 


To determine whether any of the 24 audits contained repeat findings, we obtained and 
reviewed the audit’s finding data from PEPS.”° According to the finding data, 7 of the 
12 foreign school audits contained repeat findings and should have been deemed 
deficient audits, while none of the 12 domestic school compliance audits contained 
repeat findings. We selected the seven foreign school audit reports for review in order 


17 The Multi-Regional Foreign School Participation Division had only one deficient compliance audit that 
contained at least one SAP finding within our audit scope. 


18 7,048 non-deficient compliance audits include 6,502 domestic school audits and 546 foreign school 
audits. 


19 Only the foreign school compliance audits came from the PEPS. Domestic school compliance audits 
came from the eZ-Audit system. 


20 PEPS did not contain audit finding data for some of the audits so we obtained the audit reports to 
review the findings. 
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to verify that the reports actually contained repeat findings and to verify that Program 
Compliance did not perform the required audit resolution for the seven audits. 


For the remaining 17 audits (5 foreign and 12 domestic) that did not contain repeat 
findings, we selected a random sample of 2 foreign school audits and 3 domestic school 
audits in order to determine whether the subsequent year’s audit report contained 
information related to whether the SAP-related corrective actions from the previous 
year were implemented. 


Use of Computer-Processed Data 


Our use of computer-processed data for the audit was limited to the spreadsheets 
provided by FSA’s Program Compliance office and spreadsheets of compliance audit and 
program review data we queried from PEPS. FSA’s spreadsheets contained compliance 
audit data stored in both PEPS and the eZ-Audit system, and program review data 
stored only in PEPS. Data in the spreadsheets included audit or program review control 
numbers, school names, final determination letter dates, audit findings, and program 
review deficiencies. 


Program Review Data 

We extracted program review data from PEPS, the Department’s system of record. We 
assessed the accuracy of program review data from PEPS by comparing it to source data 
(program review reports and final program review determination letters) for a sample of 
program reviews. We tested a sample of 10 program reviews with an SAP finding from a 
universe of 143 program reviews and a sample of 15 program reviews without an SAP 
finding from a universe of 424 program reviews. We did not find any material 
discrepancies between the program review data from PEPS and source documentation. 
Based on our analysis, we concluded that the program review data from PEPS was 
sufficiently reliable for the purpose of the audit. 


Compliance Audit Data 
To sample domestic and foreign school audits with at least one SAP finding, we relied on 
universes of audits from eZ-Audit (domestic school audits) and PEPS (foreign school 
audits). We did not have access to the eZ-Audit system, which is the system of record 
for audits, and relied on FSA’s extract of 80 deficient audits and 12 non-deficient audits 
from that system. To assess completeness of the lists, we confirmed the logic used by 
FSA to extract the records and validated the list by comparing to extracts we performed 
from PEPS. We also interviewed FSA staff and contractors familiar with both systems, 
reviewed existing information about the data and the system that produced them, and 
researched and resolved differences between the eZ-Audit and PEPS lists. To assess the 
data’s accuracy, we traced samples of domestic school audits from eZ-Audit and foreign 
school audits from PEPS, confirming institution name, audit control number, the Final 
U.S. Department of Education 


Office of Inspector General 
ED-OIG/A04S0012 21 


Audit Determination letter sent date, and audit findings to the source documentation 
(Final Audit Determination letters) and did not find any material discrepancies. We 
concluded that the spreadsheets of domestic compliance data from eZ-Audit and 
foreign school compliance audit data from PEPS were sufficiently reliable for the 
purpose of this audit. 


We conducted this performance audit in accordance with generally accepted 
government auditing standards. Those standards require that we plan and perform the 
audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our 
findings and conclusions based on the audit objectives. We believe that the evidence 
obtained provides a reasonable basis for our findings and conclusions based on our 
audit objectives. 
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Appendix B. Acronyms and Abbreviations 


ARS Audit Resolution Specialist 

C.F.R. Code of Federal Regulations 

Department U.S. Department of Education 

FAD Final Audit Determination 

FSA Federal Student Aid 

FY fiscal year 

PEPS Postsecondary Education Participants System 
SAP satisfactory academic progress 
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FSA Comments 


TO: Christopher Gamble 
Assistant Inspector General for Audit 
Office of Inspector General 


FROM: Mark A. Brown /s/ 
Chief Operating Officer 


SUBJECT: Draft Audit Report, “Federal Student Aid’s Oversight of Schools’ Compliance with Satisfactory 
Academic Progress Regulations,” Control Number ED-OIG/A04S0012 


Thank you for the opportunity to review and comment on the Office of Inspector General’s (OIG) draft audit 
report “Federal Student Aid’s Oversight of Schools’ Compliance with Satisfactory Academic Progress 
Regulations,” dated April 24, 2019. The purpose of the audit was to determine (1) whether Federal Student 
Aid (FSA) ensured completion of corrective actions in response to program review and audit findings 
related to satisfactory academic progress (SAP), and (2) what actions FSA has taken to assist schools with 
compliance with SAP requirements. 


FSA Response to Findings and Recommendations 
Finding No. 1: FSA Did Not Ensure Schools Completed Corrective Actions 


FSA understands the importance of and takes seriously our responsibility to provide monitoring and 
oversight of schools participating in the Title lV programs. However, we believe it is important to avoid 
overstating the issues in this finding and to place the OIG’s finding in the proper perspective. The 
exceptions identified by the OIG largely did not identify systemic issues but rather identified individual 
exceptions where a procedure was not followed based on judgmental sampling. Specifically, the OIG states 
in its draft report that the sampling it used had the following limitations: “Because we used judgment to 
determine random sample sizes and did not weight results by probabilities of selection and also used a 
judgmental sample, the results from our samples pertain only to the program reviews and compliance 
audits sampled and cannot be projected.” 


The OIG reviewed deficient compliance audits, program reviews, and non-deficient compliance audits to 
determine if FSA ensured schools completed corrective actions. Below, we provide additional information 
to place the exceptions identified within the appropriate context. 


Deficient Compliance Audits 

Out of the 2,462 deficient compliance audits resolved during the period the OIG reviewed, only 80 
contained at least one SAP-related finding. The OIG chose a judgmental sample of 15 of those 80 audits and 
found the following three exceptions within 4 of the 15 audits in the judgmental sample. 
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The first exception cited was not a failure to ensure the school completed corrective actions. The OIG states 
that FSA correctly determined that the corrective action plan to develop a compliant SAP policy would 
address the auditor’s finding. In addition, the school’s auditor determined that no students from the 
sample were ineligible due to the SAP policy at issue. However, FSA acknowledges that we did not include 
all elements required by FSA’s policies and procedures in the Final Audit Determination Letter. We agree 
that policies and procedures must be followed and will work to ensure that this type of non-systemic issue 
does not occur in the future. 


In the second cited exception, the school had 52 students in total. OIG reports that up to 52 students at the 
school may have been ineligible to receive Title IV program funds and that FSA should have requested 
documentation to determine whether those 52 students met SAP requirements because the school’s policy 
was deficient. However, the auditor did not say the entire student population was ineligible, but that 
“students may have received ineligible funds [emphasis added].” Any number of students that may have 
been ineligible would have been less than 52 students. FSA agrees that additional research should have 
been done to determine if any of the students were ineligible. We will work to ensure that this type of non- 
systemic issue does not occur in the future. 


Finally, the last exception involved audits of two schools that each provided funds to a single student who 
may have been ineligible for failing to meet SAP requirements. FSA did not require additional 
documentation from the schools to determine if the students were ineligible. It is likely one of the students 
could have been found eligible upon further review due to the unusual circumstances involved. (The 
student returned to the school after years of not attending and her prior program had been closed. SAP 
policies may permit the exclusion of credit hours and grades from the SAP determination when a student 
changes majors and those credits/grades do not count toward the new major). For the second school, 1 
student out of a sample of 60 was identified as not meeting SAP requirements. Again, FSA agrees that 
additional research should have been done to determine if either of the students at the two schools were 
ineligible and will work to ensure that this type of non-systemic issue does not occur in the future. 


Program Reviews 

OIG identified 1 program review out of its judgmental sample of 21 where FSA failed to follow the policies 
and procedures regarding closed schools. This exception was not a systemic issue for program reviews with 
SAP findings. However, FSA agrees that the policies and procedures should have been followed and is 
committed to ensuring that appropriate action is taken for all closed schools. 


Recommendation 1.1: Develop and implement controls to ensure that the Program Compliance office 
addresses all repeat findings in a final audit determination letter. 


FSA agrees with this recommendation. Although FSA believes that we have sufficient control activities 
through our extensive policies and procedures for final audit determination letters, we will evaluate these 
policies and procedures to determine if a procedure should be added to address this recommendation. FSA 
will also provide additional staff training to ensure that audit resolution staff know the required elements 
to include in a Final Audit Determination Letter. 


Recommendation 1.2: Develop and implement controls to ensure that the Program Compliance office 
follows the required policies and procedures for requesting additional documentation when it is needed 
to determine students’ eligibility for Title 1V program funds and assessing liabilities in instances where a) 
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SAP violations result in Title IV program funds being disbursed to ineligible students and b) when a school 
closes before it completes a required file review. 


FSA agrees with this recommendation. FSA believes that we have sufficient control activities through our 
extensive policies and procedures on what is required when information in an audit report indicates that a 
student or students may be ineligible or when a school closes; however, we will evaluate these policies and 
procedure to determine if a procedure should be added to address this recommendation. FSA will also 
provide additional staff training to ensure that audit resolution staff know the required actions to take 
when such audit findings occur. 


Non-Deficient Compliance Audits 

In the OIG’s review of non-deficient audits for domestic schools, it found FSA correctly classified 100 
percent of the sampled audits as non-deficient. However, for foreign schools, which represent only 1.1 
percent of total Direct Loan and Pell Grant program disbursements, the OIG identified a system issue in the 
Postsecondary Education Participants System (PEPS), the system used for foreign school compliance audits. 
Because the PEPS Deficiency Code Reference Table lacked a repeat finding code, audits for foreign schools 
with repeat findings were not flagged as deficient audits. We have corrected the coding in PEPS so that 
repeat findings are identified, and audits are correctly labeled as deficient. FSA was not aware of this 
system error and appreciates the OIG’s work in identifying this issue. The OIG also identified issues with the 
FSA contractor’s performance in coding findings for PEPS entry. We are developing a quality control process 
to oversee the contractor’s work in populating PEPS with foreign school information. 


Recommendation 1.3: Revise the system logic in PEPS to ensure that audits coded with a repeat finding 
code are identified as deficient by that system. 


FSA agrees with this recommendation and has already corrected this system issue. 


Recommendation 1.4: Develop and implement controls to prevent and detect errors in the Program 
Compliance office’s process for identifying deficient foreign school compliance audits for audit 
resolution. 


FSA agrees with this recommendation. FSA has revised the system logic in PEPS, which is one step to ensure 
that audits of foreign schools with repeat findings are correctly identified as deficient. Additionally, FSA will 


develop a quality control process to oversee the contractor’s work to populate PEPS with foreign school 
information. 


Finding No. 2: FSA Took Actions to Assist Schools with Compliance with Satisfactory Academic Progress 
Requirements 


FSA appreciates that the OIG recognized the significant ways we have been proactive to prevent violations 
of SAP requirements before they become findings in audits or program reviews. 


Again, thank you for the opportunity to review and comment on this draft report. 
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